陪伴型小龙虾 - 陪你刷抖音、看电影、听音乐、聊天分享的 AI 伙伴

This package is not obviously malicious, but it is inconsistent: the docs promise networked features (Douyin/video fetching, movie/music lookups) while the shipped code is purely local stubs. Before installing or running npm install: 1) Inspect the repository (package.json) and any dependencies for postinstall scripts and network code; 2) Verify the upstream GitHub repo and its history/maintainer; 3) Run npm install in a sandboxed environment or container to limit risk; 4) If you expect live content fetching, confirm which APIs/endpoints and credentials (if any) the skill will use and whether those are safe to provide; 5) Consider reaching out to the author or choosing a skill with implemented, auditable network integration. If you only need local conversational stubs, the included code is harmless; do not assume the advertised external fetch capabilities are implemented.

Type: OpenClaw Skill Name: companion-lobster Version: 1.0.0 The skill bundle provides a boilerplate template for a 'Companion Lobster' AI assistant designed to discuss Douyin videos, movies, and music. The core logic in `companion.js` consists entirely of placeholders and basic state management for user preferences, lacking any actual network requests, file system access, or sensitive data handling. No malicious instructions or prompt injection attempts were found in `SKILL.md` or the documentation.